DeepSeek Harness Plugin: dsh-jev-guard

Introduction¶

The plugin mechanism of DeepSeek Harness (DSH) allows logic to be inserted into the execution pipeline of an agent’s Shell commands. dsh-jev-guard is a pre-execution safety valve: before a command actually runs, it determines whether the command would irreversibly delete or overwrite a user’s real data. It uses structured decisions from the TypeSafe Jev model, combined with L0 static hard rules, to intercept or pass Shell invocations.

Plugin Positioning¶

This plugin is maintained by 7starsseeker and aims to address the issue of data loss that may occur when an agent misuses a command during execution. It is mounted on the tools/pre-execute hook in DSH and provides hard blocking capability, rather than emitting warnings only.

Core Mechanism¶

The decision process consists of three layers in a fixed order:

1. L0 static hard rules

   • Includes 21 “never allow” rules and 16 “human confirmation required” rules.
   • These rules run offline and cannot be overridden.
   • Rules match only command positions (line beginning, after semicolons ;, after pipes |, after subshell markers such as $(, etc.), and ignore mentions inside arguments.
   • Only two rules (redirect-to-device, fork-bomb) match the entire text.

2. Pre-screening

   • Commands that can be proven read-only or that only modify rebuildable content (such as caches, build outputs, or /tmp) are allowed directly.
   • This stage performs no network calls and has the lowest latency.

3. Jev semantic judgment

   • Uses the TypeSafe Jev model to answer a yes/no question: “Will this command irreversibly delete or overwrite data?”
   • Classifies results into allow, revise, or block based on thresholds.
   • Average latency is about 300ms, with minimal cost per call.

Four-State Decision¶

The plugin returns one of four states based on the above decisions, determining the next action:

• allow: Determined safe or read-only; execute directly.
• revise: Evidence is insufficient, but a safer formulation exists. The model rewrites the command and retries (providing fallback templates such as dry-run, narrowing scope, or backing up first).
• block: The command would irreversibly delete or overwrite data, or it hits a hard rule. Execution is rejected and manual intervention is required.
• escalate: Falls under the “always ask” category of hard rules, or the retry budget is exhausted. Manual confirmation is required.

Installation and Runtime¶

• Environment requirement: Node.js >= 20 (using global fetch). The plugin itself has zero runtime dependencies.
• DSH version: Verified on DSH 0.1.6-alpha.2, 0.1.7-rc.2, and 0.2.0-rc.2.
• Platform support: WSL/Linux (bash) and Windows (pwsh).
• Installation method: Install the npm package, then mount the adapter to DSH’s tools/pre-execute hook.

Common Commands¶

After installation, you can debug and monitor it using CLI tools:

# 运行自检
guard selftest

# 查看硬规则列表
guard rules

# 单独对文本进行语义判断
guard judge

# 查看运行状态
guard status

# 查看审计日志统计
guard log --stats

Behavior and Notes¶

• Fallback strategy: When the call quota is exhausted, the plugin “degrades loudly” instead of failing silently, preserving system availability.
• Fail-open design: In production, commands have been allowed when the timeout budget (1800ms) was exceeded. This is intended behavior to avoid service interruption.
• Security boundary: This plugin is an accident safety net, not a security boundary. Under very high concurrency or extreme network conditions, manual review may still be required.

Ecosystem Background¶

DSH follows an “everything is a plugin” philosophy. The community directory skillhub.cn provides an index service for plugins and has no official affiliation with DeepSeek or High-Flyer. It is recommended to review the source code and license (MIT) before use.